Add new WOLFTPM2_ECC_DEFAULT_CURVE

[dgarske]

Fixes ZD 21780

[Copilot]

Pull request overview

Adds a configurable default ECC curve for wolfTPM wrapper key templates and centralizes curve→hash selection logic to keep name/scheme hashes consistent with the chosen curve (Fixes ZD 21780).

Changes:

• Introduces TPM2_GetCurveHashAlg() to map TPM ECC curves to recommended digest algorithms based on curve size.
• Adds WOLFTPM2_ECC_DEFAULT_CURVE build-time configuration and uses it to remap P-256 template requests to the configured default curve.
• Replaces ad-hoc curve/hash selection in the crypto callback with the shared helper.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
wolftpm/tpm2.h	Declares new TPM2_GetCurveHashAlg() public API.
wolftpm/tpm2_types.h	Adds WOLFTPM2_ECC_DEFAULT_CURVE configuration macro and fallback logic.
src/tpm2.c	Implements TPM2_GetCurveHashAlg() based on curve byte size.
src/tpm2_wrap.c	Remaps P-256 template requests to the configured default curve and derives matching hashes.
src/tpm2_cryptocb.c	Uses TPM2_GetCurveHashAlg() for ECDSA template hash selection.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[aidangarske]

Skoll Multi-Scan Review

Modes: review + review-securityOverall recommendation: REQUEST_CHANGES
Findings: 3 total — 3 posted, 0 skipped
3 finding(s) posted as inline comments (see file-level comments below)

Posted findings

• [High] [review+review-security] Default-curve remap overrides explicit P-256 curve requests — src/tpm2_wrap.c:8237-8242
• [High] [review+review-security] Default-curve remap leaves policy callers using the stale SHA-256 hash — src/tpm2_wrap.c:8240-8242
• [Medium] [review] No tests cover the new default-curve behavior or hash helper — src/tpm2.c:7037-7048

Review generated by Skoll

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #519

Scan targets checked: none
Failed targets: wolftpm-bugs, wolftpm-src

⚠️ Review incomplete — one or more scan targets failed before findings could be produced. See the Fenrir PR review detail page for logs.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[aidangarske]

Skoll Code Review

Scan type: reviewOverall recommendation: COMMENT
Findings: 5 total — 3 posted, 2 skipped
3 finding(s) posted as inline comments (see file-level comments below)

Posted findings

• [Medium] New EK test assertions fail under NO_ECC256 builds — tests/unit_tests.c:2582-2586
• [Low] AIK template test does not verify the resolved nameAlg/sigHash — tests/unit_tests.c:2578-2580
• [Low] Crypto callback changes ECDSA hash for Brainpool curves — src/tpm2_cryptocb.c:237-246

Skipped findings

• [Low] New public API and build option not recorded in ChangeLog.md
• [Info] Multi-line explanatory comments exceed one-line policy

Review generated by Skoll